CVE-2025-54737

Vulnerability

Overview The Jobmonster theme (noo-jobmonster) for WordPress, versions through 4.7.8, contains a reflected cross-site scripting (XSS) vulnerability. The root cause is improper neutralization of user input during web page generation, allowing an attacker to inject arbitrary HTML or JavaScript into the response [1].

Exploitation

This reflected XSS can be triggered without authentication, but successful exploitation requires user interaction — such as clicking a specially crafted link or visiting a maliciously prepared page. The vulnerability is classified as moderately dangerous and is expected to be used in mass-exploit campaigns targeting many websites at once [1].

Impact

An attacker can inject malicious scripts (e.g., redirects, advertisements, or other HTML payloads) that execute in the context of a visiting user's browser. This can lead to defacement, data theft, or further compromise of the site [1].

Mitigation

The vulnerability has been fixed in version 4.7.9 of the theme. Immediate update to 4.7.9 or later is recommended. For sites that cannot update immediately, Patchstack has issued a mitigation rule to block attacks until the patch is applied [1].